use constant WINDOW_SIZE => 60 ; #in seconds, 60 = one min

#init for populating the first window info

my %window;
my $CRITERIA = 'update';

open LOG, "sample.log";
my ($start, $end, $count, $max, $max_line,$line_nr);
$start = $end = 0;

while (<LOG>){
	next unless /$CRITERIA/;
	my $time = parseTime($_);

	# one new user @ $time
	$window{$time}++;
	$count++;

	if ( $time - $start >= WINDOW_SIZE ){
		# slide time window, discard out-dated entires and release memory
		if ( $time - $end >= WINDOW_SIZE ){
			# if current time outdates all old values, discard entirely
			%window = ();
			$start = $end = $time;
			$count = 1;
		} else {
			# else slide window
			for ( my $i = $start; $i < $start + $time - $end; $i++ ){
				if ( defined $window{$i}) {
					$count -= $window{$i};
					delete $window{$i};
				}
			}
		}

		$start += $time - $end;
		$end = $time;
		#
	}
		
	($max, $max_line, $line_nr) = ($count, $_, $. ) if $count > $max;
}

print "PCU: $max\nLast log line:${max_line}Line #:$line_nr";

sub parseTime{
	my $line = shift;
	$line =~ /\S+\s+(\S+)/;
	my $timeString = $1;
	my ($h,$m,$s,$ms);
	$timeString =~ /(\d+):(\d+):(\d+):(\d+)/;
	my $time = $1*3600+$2*60+$3;
	return $time;
}
